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Abstract. It is well known that, in theory, the general secure multi-party 
computation problem is solvable using circuit evaluation protocols. However, 
the communication complexity of the resulting protocols depend on the size of 
the circuit that expresses the functionality to be computed and hence can be 
impractical. Hence special solutions are needed for specific problems for effi- 
ciency reasons. The point inclusion problem in computational geometry is a 
special multiparty computation and has got many applications. Previous pro- 
tocols for the secure point inclusion problem are not adequate. In this paper we 
modify some known solutions to the point inclusion problem in computational 
geometry to the frame work of secure two-party computation. 
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1. Introduction 



^ ' The rapid growth of networks has opened up tremendous opportunities for co- 

, operative computation, where the output depends on the private inputs of several 

entities. These computations could even occur between mutually untrusted enti- 
ties or competitors. The problem is trivial if the context allows to have a trusted 
entity that would know the inputs from all the participants; however if the context 
, disallows this, then the techniques of secure multi-party computation are used to 

' provide useful solutions. 

, Generally speaking, a secure multi-party computation problem deals with com- 

puting a function in a distributed network where each participant holds one of 
the inputs, ensuring that no more information is revealed to a participant in the 
' computation than that can be computed from that participant's input and out- 

put. The history of the multi-party computation problem is extensive since it was 
introduced by Yao [1] and extended by Goldreich, Micali, and Wigderson [2j and 
by many others. These works use a similar methodology: each functionality F 
is represented as a Boolean circuit, and then the parties run a protocol for every 
gate in the circuit. The protocols it generates depend on the size of the circuit. 
This size depends on the size of the input and on the complexity of expressing 
F as a circuit. If the functionality F is complicated, using the circuit evaluation 
protocol will typically not be practical. Therefore, Goldreich [3] pointed out that 
using the solutions from these general results for special cases of multi-party com- 
putation could be impractical; special efficient solutions should be developed for 
specific problems. This is the motivation for seeking solutions to specific cooper- 
ative computational problems, in which the solutions are more efficient than the 
general theoretical solutions. To this end some problems such as comparing two 
private numbers [H [H [SI [7] , privacy preserving data mining [51 [S] , comparing in- 
formation [TU], privacy preserving geometric computation [TT], privacy preserving 
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cooperative scientific computation [T^ [T3] , privacy preserving database query [T3] , 
privacy preserving auction |15j , privacy preserving statistical analysis [16| I17j , pri- 
vacy preserving set operations |18j have been investigated. 

In secure multi-party computational geometry we seek secure protocols for sev- 
eral geometric problem like point inclusion problem, intersection of two shapes, 
range searching problem etc where the data is shared by two or more entities. In 
this paper, we construct secure two-party protocols for the point inclusion problem 
in star-shaped domains and more complex polygonal domains. Here, one entity 
Alice has a point M, and Bob has a polygon P. Their aim is to determine whether 
M is inside P, or not without revealing to each other their private inputs. 

We outline the related work in Section 2. In Section 3, we introduce our adversary 
models as well as the cryptographic tools used in the subsequent sections. In 
sections 4, we study the point inclusion problem in star-shaped domains and in 
Section 5, we consider more general polygonal domains. The paper concludes with 
some remarks in Section 6. 

2. Related Work 

The secure multiparty computational geometry has got wide applications in the 
fields of military, computer graphics etc. The study of secure multiparty computa- 
tional geometry was initiated by Atallah et al. with their work on secure point 
inclusion problem and polygonal intersection problem. Their protocol for the point 
inclusion problem is applicable to simple polygonal domain and has complexity 
0{n) where n is the number of edges of the polygon. Later Li et al. studied the 
point inclusion problem for circular domain. However, their solution is not secure 
in the sense that each party gets additional information regarding the location of 
the other party's object. Moreover, their solution is highly inefficient. A more 
efficient protocol for the point inclusion problem in a circular domain was recently 
proposed by Luo et al. |20j . 

In this paper we consider the point inclusion problem in a star-shaped domain 
and a more general polygonal domain (can have several disconnected nested com- 
ponents). Two protocols for the star shaped domain with round complexities 0{n) 
and 0(log n) respectively, and a protocols for more general polygonal domain with 
round complexity 0{n), where n is the number of vertices are given. 

3. Preliminaries 

In this section we state our security assumptions and list the building block for 
our protocols. 

3.1. Security Assumption. We assume that all parties are semihonest. A semi- 
honest party is the one who follows the protocol correctly with the exception that 
it keeps a record of all its intermediate computations and might derive the other 
parties inputs from the record. 

The existing protocols listed below serve as important building blocks for our 
protocols. 

3.2. Homomorphic Encryption Schemes. An encryption scheme is homonior- 
phic if for some operations © and 0, Ek{x) ® Ek{y) = Ek{x ® y), where x and 
y are two elements from the message space and k is the key. Many such systems 
exist, and examples include the systems by Benaloh [21], Naccache and Stern [22], 
Okamoto and Uchiyama [53], Paillier [21], to mention a few. A useful property of 
homomorphic encryption schemes is that an addition operation can be conduced 
based on the encrypted data without decrypting them. 
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3.3. Yao's Millionaire Protocol. The purpose of this protocol is to compare 
two private numbers and to determine which one is larger without revealing the 
numbers. This was first proposed by Yao [IJ and is referred as Yao's Millionaire 
Problem (because two millionaires wish to know who is richer, without revealing 
any other information about their net wealth). The early cryptographic solution 
by Yao [IJ uses an untrusted third party and has communication complexity that 
is exponential in the number of bits of the numbers involved. Cachin proposed a 
solution [15 f based on an untrusted third party that can misbehave on its own (for 
the purpose of illegally obtaining information about Alice's or Bob's private vec- 
tors) but does not collude with either participant. The communication complexity 
of Cachin's scheme is 0{l), where I is the number of bits of each input number. Re- 
cently many efficient protocols which do not need a third party have been suggested 
by various authors [H \S\ . 

3.4. Scalar Product Protocol. Let Alice has a vector X = {xi, . . . , a;„) and Bob 
has a vector Y ~ (yi, . . . ,y„). The scalar product protocol is to securely compute 

n 

the scalar (dot) product of X and Y, given by X.Y — ^ Xii/i. 

k=l 

In [llj Du and Atallah considered a slightly different and more general form of 
the scalar product protocol in which Alice has the vector X and Bob has the vector 
Y, and the goal of the protocol is for Alice (but not Bob) to get X.Y + V where 
V is random and known to Bob only. Their protocols can be easily modified to 
work for the version of the problem where the random V is given ahead of time as 
part of Bob's data (the special case ^ = puts us back to the usual scalar product 
definition). They had developed two protocols for it. Secure protocols for the scalar 
product problem can be found in [TTJ [521 [IS] ■ 

4. Point Inclusion in Star-shaped Domain 

In this section, we study the point inclusion problem in a star-shaped polygonal 
domain. 

Problem: Let Alice has a point M and Bob has a star-shaped polygon P with ver- 
tices Pi, for 1 < i < n, where the vertices are named in the anticlockwise direction. 
Alice and Bob want to securely check whether M lies inside (including boundary) 
P or not. 

Since P is a star-shaped polygon, it contains a point Q such the line segments 
joining Q to Pi for 1 < i < n lies entirely in P. We have the following algorithm 
for point inclusion from [27j . 

The Point Inclusion Protocol Without Privacy 

(1) Determine by binary search the wedge in which M lies. Af lies in the wedge 
bounded by the rays QPi and QPi+i if and only if the angle formed by M, 
Q and Pi is a left turn and the angle formed by M, Q and Pi+i is a right 
turn. 

(2) Once Pi and Pi+i are found, then M is internal if and only if the angle 
formed by Pi, Pi+i and M is a left turn. 



Theorem 4.1. [27 The inclusion question can he answered in 0{\ogn) time, given 
0{n) space and 0{n) processing time. 



4 



SECURE TWO-PARTY PROTOCOLS FOR POINT INCLUSION PROBLEM 



To decide whether the angle ZP1P2-P3 is a right or left turn corresponds to evalu- 
ating a 3 X 3 determinant in the points' coordinates. Let Pi = {ai, bi) for 1 < i < 3. 
The determinant 

ai hi 1 

D{PuP2,Pz)= 02 62 1 

03 63 1 

gives twice the signed area of the triangle AP1P2P3, where the sign is + if and only 
if (Pi, P2, P3) forms a counterclockwise cycle. 

Let the coordinates of M be (a, 5) and that of Q be {s,t) with respect to some 
coordinate system known to both Alice and Bob. Now Bob chooses a new coordinate 
system with origin at Q and axes parallel to the original axes. Let the co-ordinates 
of Pi with respect to the new coordinate axes be {ai,bi) for 1 < i < n. The new 
coordinates of M becomes {a — s,a — t). Now the angle ZMQPi is a right turn or 
left turn according as the determinant 

a — s b — t 1 
D{M,Q,Pi)= 1 

Gi bi 1 

is positive or negative. For 1 < « < n, let A = (a, 6, 1), Pj = {—bi, ai, sbi — tUi) and 
Ci = {{bi - bi+i), -{ai - tti+i), -s{bi - bi+i)+t{ai - Oj+i) -|- (0,6^+1 - biUi+i). Now 
we have, 



D{M,Q,Pi) 
D{Pi,Pi+i,M) 



— {a — s)bi + {b — t)ai = ~abi + bai + {sbi — tai) 
(a, 6, !).(— 6,;, a,;, sbi — tai) = A.Bi. 

(a - s){b, - bi+i) - {b- t){ai - Oi+i) + {aibi+i - 6^0^+1) 
a{bi - bi+i) - b{ai - a^+i) - s{bi - bi+i) + t{ai - a^+i) 
+{aibi+i - biai+i) 

{a, b, l).{{bi - bi+i), -{ai - a^+i), -s{bi - bi+i) + t{ai - a^+i) 
+{aibi+i - bitti+i) = A.Ci. 



The point M lies in the wedge bounded by the rays QPi and QP^+i if and only if 
A.Bi < and A.Pj+i > and if it happens to lie in that wedge, it lies inside the 
polygon if and only if A.Ci < 0. Note that Alice has the vector A and Bob has the 
vectors Bi and Ci for 1 < i < n. We now give the corresponding secure protocol 
for the point inclusion problem. 



The Secure Point Inclusion Protocol 4.1 



(1) For i = 1, . . . , n, Alice and Bob do the following: 



(a) Bob computes Bi, Ci and chooses at random Vi and Wj. 

(b) Alice engages in two secure scalar product protocols with Bob and gets 
Ui = A.Bi + Vi and Zi = A.d + W^. 

(c) Alice compares Ui with Vi and Zi with Wi using millionaire protocol 
with Bob. 



(2) Alice identifies the index, i = j at which Uj < Vj and Uj+i > Vj+i. 

(3) Alice looks at the millionaire protocol output for the pair Zj and Wj . If Zj 
was smaller than Wj then the point is inside else it is outside. 

(4) Alice communicates the result to Bob. 



Analysis of the Protocol 4.1 
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Theorem 4.2. The Protocol 4-1 is correct, secure and has round complexity 0{n). 

Proof. Correctness: Using the miUionaire protocol, in Step 2 Ahce identifies the 
wedge in which the point M Ues and in Step 3 she checks whether the point M 
hes inside or outside the polygon. The correctness of the protocol follows from the 
correctness of the corresponding insecure protocol. 

Security: The security of the protocol immediately follows from the privacy of 
the secure scalar product protocol and that of the secure protocol for the million- 
aire problem. Also, Alice does not reveal to Bob the wedge in which M lies, and 
so Bob will not get any idea about the location of the point M. 

Round Complexity: It is easy to see that the round complexity of the proto- 
col is 0{n). □ 

Using Bineiry Search to Reduce Round Complexity 

Now, we will incorporate binary search in the above protocol to reduce its round 
complexity to O(logn). 

Let E he & homomorphic commutative encryption scheme. That is if {Ea,Da) 
and {Eb, .Ds) be the encryption and decryption pairs of Alice and Bob correspond- 
ing to their keys and let E = Ea or Eb, then 

(1) Ea{Eb{x)) = Eb{Ea{x)); 

(2) E{x)*E{y)=E{x.y). 

Given U = {ui, . . . , Un), let E{S) = {E{ui), . . . , E{un))- We now give the modified 
secure protocol for the point inclusion problem. 

The Secure Point Inclusion Protocol 4.2 

(1) For 1 < i < n, Bob computes bi = EsiBi), and Cj = EB{Ci). 

(2) Bob sends . . . , 6„) and (ci, . . . , c„) to Alice. 

(3) Alice picks an r randomly such that 1 < r < n and cyclically rotates the lists 

obtained from Bob by r positions to get (6i+r, . . . ,br) and (ci+r, • • • , Cr)- 

(4) Alice sends {EA{bi+r), ■ ■ ■ , EA{br)) and {EA{ci+r), ■ ■ ■ , -^^(cr)) to Bob. 

(5) Bob decrypts the list obtained from Alice with his private key Db and 
obtains 

iDB{EA{bi+r)),...,DB{EA{br))) = {E A{Bi+r) ., . . . .E A{Br)) , 
(DB(EA{ci+r)),---,DB{EA{Cr))) = {EA{Ci+r), . . . , EA{Cr)). 

(6) Ahce computes Ea{A). 

(7) Alice identifies the index, i = j for which A.Bj < and A.Bj+i > using 
the following sub protocol in the binary search. 

(a) For each index k Alice picks up in the binary search, Bob picks a 

random > encrypts with his key and sends Alice Esirk). 

(b) Alice encrypts with her key and sends back to Bob EA{EB{rk))- 

(c) Bob decrypts and obtains DB{EA{EB{rk))) = EA{rk)- 

(d) Bob computes EB{rk) * EB{Bk) ^ EB{rkBk). 

(e) Alice engages in a secure scalar product protocol with Bob and obtains 
Ea{A) * EAivkBk) = EA{rk{A.Bk)). 
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(f) Alice decrypts and obtains DA{EA{rk{A.Bk)) = rk(A.Bk) and checks 
whether it is positive or not. 

(8) Ahce checks whether A.Dj is negative or positive using a similar sub pro- 
tocol as in Step 7. If it is negative, the point is inside else it is outside. 

(9) Alice communicates the result to Bob. 

Analysis of the Protocol 4.2 

Theorem 4.3. The Protocol 4-^ is correct, secure and has round complexity O(logn). 

Proof. Correctness: It is clear that, in Step 5, Bob gets the encryption of the vec- 
tors Bi and Ci for \ < i <n with the key of Alice. For each index k occurring in the 
binary search, Alice has Ea{A) and Bob has EA{rkBk)- Using the secure scalar 
product protocol she obtains Ea{A) * EA{rkBk), which is equal to EA{rkA.Bk) 
from the homomorphic property of the encryption scheme. By decryption using 
her private key Alice gets rk{A.Bk) and she can check whether A.Bk > 0, since 
Tfc > 0. Thus Alice can identify the wedge in which the point M lies. Similarly, 
once the wedge is identified, she can check whether the point lies inside the poly- 
gon or not. Thus the correctness of the protocol follows from the correctness of the 
corresponding insecure protocol. 

Security: Since Bob is sending Bi and Ci for 1 < i < n, after encryption with his 
key, Alice will not get any information about the private data of Bob. Since Alice 
rotates the list of Bi and Ci after masking with her key, Bob will not get any idea of 
the specific Bi and Ci Alice is using in the binary search in Step 7. Hence, Bob will 
not get any idea of the wedge in which the point M lies. The privacy of the secure 
scalar product protocol guarantees the privacy of the individual inputs during the 
scalar product computation in Step 7 and Step 8. Also since rk is random known 
only to Bob, the only information Alice can get from the scalar product is its sign. 

Round Complexity: As Alice is using binary search in the identification of the 
wedge in which the point M lies, it is clear that the round complexity of the protocol 
is O(logn), since the complexity of the binary search is O(logn). □ 

5. Point Inclusion in More General Polygonal Domain 

In this section, we consider an algorithm for the point inclusion problem for a 
more general polygonal domain given in [2S] . This domain is more general than any 
of the domains so far considered in the context of secure point inclusion problem. 

Problem: Alice has a point M and Bob has a polygon P that may have mul- 
tiple disconnected nested components, with vertices Pi,...,P„. Alice and Bob 
wants to securely check whether M lies inside (including boundary) P or not. 

The characteristic function, x{M) of the polygon P is defined as. 



where M e M^. Let < < 2tt, be the included angle (edges swept inside the 
polygon) at a vertex V. The extension to oo in both directions of the edges incident 
on the vertex V divide the plane into 4 wedges. If < tt (convex vertex), there are 
two wedges with angle 9 and two wedges with angle tt — 6. We call the wedges with 
angle 6 as inner and those with angle tt — 6* as outer, li 6 > tt (concave vertex). 




1 if M lies on or inside P; 
otherwise. 
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there are two wedges with angle 2tt — 9 and two wedges with angle 9 — ir. In this 
case, we call the wedges with angle 27r — as inner and those with angle 6* — tt as 
outer. 

We assume for convenience that the point M does not lie on any of the four rays 
emanating from any of the vertices of the polygon. The case in which M lies on a 
ray can be easily handled separately. Now, the cross function, (M) of a point 
M with respect to a vertex V of the polygon is defined as 

i — TT- if ^ < TT and M is in an inner wedge; 
— S- if 9 < TT and M is in an outer wedge; 
TT — h if 9 > n and M is in an inner wedge; 
J- if 6* > TT and Af is in an outer wedge. 




Theorem 5.1. |28j The characteristic function of the whole polygon is the sum of 
the cross functions of its vertices. That is 

Before we give the secure protocol for the point inclusion problem, we outline a 
way for Alice to securely identify whether her point lies in an inner or outer wedge 
corresponding to a vertex V. Bob chooses four points Vi, V2, V3 and P4 on the four 
rays emanating from the vertex V . Without loss of generality let us suppose that 
VVi and VV2 bound one inner wedge and FV3 and VV4, bound the other one. Now 
Alice and Bob engages in a secure protocol (as described in the previous section) 
and Alice checks whether M is inside any of these two wedges. If that is the cases 
M is inside an inner wedge else M is inside an outer wedge. 

For 1 < i < n, let 9i be the included angle at the vertex Pi. We now give a 
secure protocol for the point inclusion problem. 

The Secure Point Inclusion Protocol 5.1 

n 

(1) Bob computes 9 — where = if Vi is a convex vertex 

{9i < tt) and rrii — 1, otherwise. 

(2) For 1 < i < n Alice and Bob do the following. 

(a) For the vertex Vi, Alice checks whether M lies inside an inner or outer 
wedge using the protocol described above. 

(b) If the wedge is inner, Alice assigns Ui = ^, else she assigns Ui — 0. 

(c) If the edge is convex Bob assigns Vi = 1, else he assigns Vi = —1. 

(3) Ahce assigns U = (ui, . . . , u„). 

(4) Bob assigns V = {vi, . . . ,Vn). 

(5) Bob engages in a secure scalar product protocol with Alice and gets U.V. 

(6) Bob computes x(M) = U.V + 9. 

(7) Bob communicates the result to Alice. 

5.1. Analysis of the Protocol 5.1. 

Theorem 5.2. The Protocol 5.1 is correct, secure and has round complexity 0{n). 
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Proof. Correctness: Let Ei be the set of convex vertices where the point M lies 
in an inner wedge, E2 be the set of convex vertices where the point M lies in an 
outer wedge, E3 be the set of concave vertices where the point M hes in an inner 
wedge and E4 be the set of concave vertices where the point M hes in an outer 
wedge. Then we have. 



V=Pi 

El ^ — ^ Oi — ^ Oi 1 ^ — ^ 
2^2^^^ "2^ ^'^2^"2^'^2^ 

n „ 
i=l 

Thus Bob can compute x(Af) and hence the protocol is correct. 

Security: The security of the protocol immediately follows from the privacy of 
the secure scalar product protocol and that of the secure protocol for the million- 
aire problem. 

Round Complexity: It is clear that the round complexity of the protocol is 
0{n). □ 



6. Conclusion 

In this paper, we studied the point inclusion problem for polygons in 2 dimen- 
sion. The Protocol 4.2 for the star shaped domain has far better round complexity 
than the existing protocols. The Protocol 5.1 for the general polygonal domains is 
applicable for a large class of polygonal domains than the existing protocols. We 
hope to extend these ideas to more general domains and to higher dimensions. 
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